{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/cryptography/issues/3713","repository_url":"https://api.github.com/repos/pyca/cryptography","labels_url":"https://api.github.com/repos/pyca/cryptography/issues/3713/labels{/name}","comments_url":"https://api.github.com/repos/pyca/cryptography/issues/3713/comments","events_url":"https://api.github.com/repos/pyca/cryptography/issues/3713/events","html_url":"https://github.com/pyca/cryptography/issues/3713","id":237275616,"number":3713,"title":"Allow signing to exclude hash constant","user":{"login":"atagar","id":1195011,"avatar_url":"https://avatars0.githubusercontent.com/u/1195011?v=3","gravatar_id":"","url":"https://api.github.com/users/atagar","html_url":"https://github.com/atagar","followers_url":"https://api.github.com/users/atagar/followers","following_url":"https://api.github.com/users/atagar/following{/other_user}","gists_url":"https://api.github.com/users/atagar/gists{/gist_id}","starred_url":"https://api.github.com/users/atagar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atagar/subscriptions","organizations_url":"https://api.github.com/users/atagar/orgs","repos_url":"https://api.github.com/users/atagar/repos","events_url":"https://api.github.com/users/atagar/events{/privacy}","received_events_url":"https://api.github.com/users/atagar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-06-20T16:44:41Z","updated_at":"2017-06-20T16:52:21Z","closed_at":null,"body":"Hi lovely cryptography folks. I just added the ability to [sign server descriptors](https://gitweb.torproject.org/stem.git/commit/?id=9a947c6) similar to what the tor process does but ran into one rough bit. In particular when cryptography makes an RSA signature it embeds a constant indicating the hash it uses whereas tor does not. This is buried pretty deep within cryptography's innards so I had to **[do an icky hack to be compatible with tor](https://gitweb.torproject.org/stem.git/commit/?id=a41767c)**.\r\n\r\nNo doubt cryptography is doing the perfectly right thing here, but would you mind adding an option either to RSAPrivateKey's sign() method or the MultiBackend to omit this so we can drop the hack? In particular it's just two lines in the **_rsa_sig_sign() method of cryptography/hazmat/backends/openssl/rsa.py** we'd like to avoid...\r\n\r\n```\r\n197     res = backend._lib.EVP_PKEY_CTX_set_signature_md(\r\n198         pkey_ctx, evp_md)\r\n199     backend.openssl_assert(res > 0)\r\n```\r\n... to...\r\n\r\n```\r\nif include_hash_constant:\r\n  res = backend._lib.EVP_PKEY_CTX_set_signature_md(pkey_ctx, evp_md)\r\n  backend.openssl_assert(res > 0)\r\n```\r\n\r\nCheers! -Damian"},"comment":{"url":"https://api.github.com/repos/pyca/cryptography/issues/comments/309820521","html_url":"https://github.com/pyca/cryptography/issues/3713#issuecomment-309820521","issue_url":"https://api.github.com/repos/pyca/cryptography/issues/3713","id":309820521,"user":{"login":"atagar","id":1195011,"avatar_url":"https://avatars0.githubusercontent.com/u/1195011?v=3","gravatar_id":"","url":"https://api.github.com/users/atagar","html_url":"https://github.com/atagar","followers_url":"https://api.github.com/users/atagar/followers","following_url":"https://api.github.com/users/atagar/following{/other_user}","gists_url":"https://api.github.com/users/atagar/gists{/gist_id}","starred_url":"https://api.github.com/users/atagar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atagar/subscriptions","organizations_url":"https://api.github.com/users/atagar/orgs","repos_url":"https://api.github.com/users/atagar/repos","events_url":"https://api.github.com/users/atagar/events{/privacy}","received_events_url":"https://api.github.com/users/atagar/received_events","type":"User","site_admin":false},"created_at":"2017-06-20T16:52:21Z","updated_at":"2017-06-20T16:52:21Z","body":"Hi Paul. Certainly. Here's the tor specification and example descriptors...\r\n\r\nhttps://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n590\r\nhttps://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n542\r\nhttps://collector.torproject.org/recent/relay-descriptors/server-descriptors/"}}
{"actor":{"display_login":"atagar"}}